Aws Smithy Json
Monthly
Denial of service in the aws-smithy-json Rust runtime crate (versions before 0.62.7) lets remote unauthenticated attackers abort a process via stack exhaustion. Because the smithy-rs code generator wires this crate's deserializer into every generated struct, any smithy-rs generated server that parses JSON is exposed, and a single small HTTP request carrying deeply nested JSON triggers uncontrolled recursion in the unknown-key skip path. No public exploit was identified at time of analysis and the flaw is not in CISA KEV, but the trigger is trivial and a vendor patch is available.
Denial of service in the aws-smithy-json Rust runtime crate (versions before 0.62.7) lets remote unauthenticated attackers abort a process via stack exhaustion. Because the smithy-rs code generator wires this crate's deserializer into every generated struct, any smithy-rs generated server that parses JSON is exposed, and a single small HTTP request carrying deeply nested JSON triggers uncontrolled recursion in the unknown-key skip path. No public exploit was identified at time of analysis and the flaw is not in CISA KEV, but the trigger is trivial and a vendor patch is available.